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Abstract. We compare the effect of different noise scenarios on the achievable rate 
of an e-secure key for the BB84 and the six-state protocol. We study the situation 
where quantum noise is added deliberately, and investigate the remarkable benefit 
for the finite key rate. We compare our results to the known case of added classical 
noise and the asymptotic key rate, i.e. in the limit of infinitely many signals. As a 
complementary interpretation we show that under the realistic assumption that the 
noise which is unavoidably introduced by a real channel is not fully dedicated to the 
eavesdropper, the secret key rate increases significantly. 
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1. Introduction 

Quantum key distribution (QKD) aims at establishing a secret key between two parties 
Alice and Bob, who are connected via a quantum channel and an authenticated classical 
channel. In the last few years, in addition to the studies of asymptotic QKD (i.e. the 
unrealistic case of infinitely many signals, which is more accessible theoretically), more 
realistic QKD scenarios have been analyzed, where the number of signals sent through 
the channel is finite EHEJEISIIHIEIITIIHIEI HOl HH H21 [13]. 

A general aim in studies of security in QKD is to determine a scenario in which 
the secure key rate is as high as possible. It has been shown that pre-processing 
methods [U [HI EE EE El EE [EH], like for example adding classical noise pQ or 
advantage distillation [1] can increase the secure key rate significantly. Note that those 
investigations have focused on pre-processing operating on the classical level. By the 
addition of quantum noise a beneficial effect in asymptotic QKD (on the level of mutual 
information) has been shown in [20] for the six-state protocol [211 E2] • However, for a 
finite number of signals the mutual information of Alice and Bob versus the one of the 
eavesdropper Eve is not a direct indicator for the secret key rate. 

The purpose of this article is to investigate the effect of quantum noise on secret 
key rates with finite resources for the BB84 [23] and six-state protocol [21] [22]. We will 
analyse our results for two complementary interpretations: First, we present different 
quantum noise scenarios, where the noise is added on purpose, and investigate its benefit 
for the secret key rate. Second, we interpret the added noise as the unavoidable noise 
introduced by a real channel. We then show how the secret key rate can be improved 
if we consider the noise introduced by the channel as not fully due to the interaction of 
an eavesdropper. We compare the results to the known effect of classical noise and the 
case of infinitely many signals. For the investigation we consider the BB84 and six-state 
protocol in the entanglement-based scheme under the assumption of collective attacks. 
We use the asymptotic equipartition property (AEP) [TJ [21] to bound the smooth min- 
entropy [I] in the high- dimensional Hilbert space, such that the e-secure key rate can 
be mainly determined by the conditional von Neumann entropy of a single-signal-state. 
Note that here, for key rates in the finite regime, the assumption of collective attacks 
is necessary, since the equivalence of collective and coherent attacks for the BB84 and 
the six-state protocol has so far been proven only in the limit of infinitely many signals 
[251 [26]. 

The paper is structured as follows: In Section [2] we introduce the general framework 
and fix the notation. The different noise scenarios are presented and discussed in 
Section [3] Section @] deals with the calculation and optimization of e-secure key rates 
for these different noise scenarios. The results are given in Section [51 followed by a 
conclusion in Section El 
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2. Preliminaries 

In the following we consider the BB84 and six-state protocol in the entanglement-based 
scheme, where the eavesdropper Eve can only interact with the signals (labeled by B) 
which are sent through the quantum channel. The most general unitary interaction Ube 
that Eve can perform is given by [27] 

U BE |0> fl \X) E = VT^D \0) B \A) E + VTJ \1) b \B) e (2.1) 
U BE \l) B \X) e = VT^D \1) B \C) E + VTJ \0) b \D) e , (2.2) 

where \X) E is Eve's initial state and \A) E , \B) E , \C) E , \D) E refer to her 4-dimensional 
states after the transformation. The parameter D G 0, | corresponds to the 
disturbance, i.e. the quantum bit error rate (QBER) introduced by Eve if the quantum 
channel is otherwise noiseless. 

Throughout our paper we will study quantum noise which is given by a depolarizing 
channel. (Note that our calculations could in principle be generalized to other models 
for quantum noise, but the lower the symmetry of the channel, the more involved the 
calculations will be.) The action of the depolarizing channel is described by the map 
M p (p), where p is the noise parameter. 

Definition 1. The action of a depolarizing channel M p (p) is given by 

N*{p):=Y t AiPA (2-3) 



with the Kraus operators A\ = yl — |pl,A2 = yfa Xl A^ = ^"^Oy^andA^ = yfoz- 
Here, o~i are the P auli- operators for i G {x,y,z}. 

Analogously, we define classical noise [1] via the map M d ' p (p). 

Definition 2. The action of a classical noisy channel is given by 

N d *{p):=Y,B iP Bl (2.4) 



with B x = Jl - §1 and B 2 



2 " 

Note that this definition is different from the usual definition of classical noise in 
the literature: throughout our paper the probability to flip a bit is called | instead of 
p. This choice of p allows a fair comparison of the two different noise models (quantum 
versus classical) for the same parameter p, ranging from to 1. 

Our central figure of merit is the ^-secure key rate for a finite number of signals. 
We will use this quantity in the following to compare different noise scenarios. The e- 
secure key rate is calculated for a typical protocol that consists of the procedures state 
distribution, measurement, sifting, parameter estimation (PE), one-way error correction 
(EC) and privacy amplification (PA). Let £pe,£ec and Epa be the probability of failure 
for the protocol steps parameter estimation, error correction and privacy amplification, 
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respectively. Then with a smoothing parameter e we can bound the total security of 
the protocol by 

£ := e + e PE + e E c + ^pa- (2.5) 

For such a protocol it has been shown in [TJ [6] that the rate of an e-secure key is given 
by 

r = i min (p XE \E) - nf EC H(X\Y)) + 1 log (2e PA ) , (2.6) 

where the smooth min-entropy [1] 

H Lm (Pae\E) := sup sup # min (a AE \p E ) (2.7) 

is defined as an optimization of the min-entropy 

#min {<tae\pe) := sup {a G J? : 2~ x l A ® p E - o AE > o} (2.8) 
over an £-environment given by 

& (p) := {* : - Plb < e} , (2.9) 



with the 1-norm 1 1 1 1 1 = tr (V AA^J . Here, S(H) denotes the set of density operators 
on the Hilbert space H. The smooth min-entropy of the classical-quantum state 
Pxe shared by Alice and Eve and the correction 2 log 2 (2£pa) are due to privacy 
amplification. It quantifies Eve's uncertainty of Alice's and Bob's perfectly correlated 
bitstring. The term JecH(X\Y) stands for the number of bits which Alice and Bob leak 
to the eavesdropper due to public communication during the error correction procedure. 
H(X\Y) denotes the conditional Shannon entropy H(X\Y) = H(pxy) — H(py) with 
H(X) = — J2xP{ x ) log (p{ x ))- F° r simplicity we consider an ideal error correction 
protocol, i.e. /ec — 1- The minimization of the smooth min-entropy is due to parameter 
estimation, where we only except qubit-states p A B which are contained in the set [5j [10] 

1 '|A m (p)-A 00 (p)|| 1 <C(£PE,2,m)| (2.10) 



P '-2 



with 



In ( — ) + n v In (m + 1 ) 

C(£ P E,n p ,m) := X WeJ P (2.11) 

\ 8m 

where X m (p) (Aoo(p)) denotes the measurement statistics due to an m (m — > oo)-fold 
independent application of a measurement. 

Under the assumption of collective attacks, i.e. p XE = p x n E we can use the AEP 

mm 



(pTe\e) > n ( S(X\E) - 5^/^^ ) (2.12) 
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to bound the smooth min-entropy for product states p x n E by the conditional von 
Neumann entropy of a single copy pxe which is defined as S(X\E) = S(pxe) — S(pe) 
with S(p) = — tr (plogp). Finally, this leads to 



r:=^ min [S(X\E) - 5 _ H (X\Y) ) + 1 log (2e PA ) (2.13) 

is PAser c l y n I IS 

3. Noise scenarios 

In this section we present four different noise scenarios which we will investigate in 
the following. Initially, if no noise is present, Alice holds one part of the Bell-state 
|^+) with 

* + ) = ^(|01> + |10», (3.1) 

and sends the second part to Bob, while the eavesdropper can perform a unitary 
interaction Ube characterized by a disturbance D (see Equation (12. ip ) on it. Let us 
denote the map that corresponds to the unitary interaction Ube as Sbe- The total state 
after the action of Sbe is then given by 

pf BE = (1 A ® S BE ) (|* + ) (V + \ AB ® \X) (X\ E ) , (3.2) 

where \X) (X\ E denotes Eve's initial state. 

Now, four different noise scenarios are considered: 

(1) Alice adds depolarizing quantum noise with noise parameter p a to her part of the 
Bell-state and sends the other part to Bob (see Figured]). This leads to the state 

p% E = (t A ® £ BE )W ® *be) (|^ + ) (V + \ AB O \X) (X\ E ) . (3.3) 

Note that there is obviously no difference between adding Alice's noise before or 
after Eve's interaction, since they act on different Hilbert spaces. 

(2) Alice adds depolarizing noise with noise parameter pb to Bob's part of the Bell-state 
and sends it to Bob (see Figure [2]). This leads to the state 

pf BE = (1 A ® £ BE )(1 A ® Mb ® 1e) (|^ + ) (* + \ ab ® \X) (X\ E ) . (3.4) 

(3) Bob adds depolarizing noise with noise parameter p n b to his part of the Bell-state 
after Eve's interaction (see Figure |3J). This leads to the state 

Pabe = (1a O K nb ® 1b)(1a ® S BE ) (|^ + ) (^ + \ ab ® \X) (X\ E ) . (3.5) 

(4) Alice introduces classical noise with noise parameter p c \ to her classical bit string 
after her measurement (see Figure HJ) . 

How do these four scenarios compare, when evaluating the e-secure key rate? 
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Figure 1. Noise scenario 1; Alice adds depolarizing quantum noise to her part of the 
initial state. 
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Figure 2. Noise scenario 2; Alice adds depolarizing quantum noise to Bob's part of 
the initial state. 
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Figure 3. Noise scenario 3; Bob adds depolarizing quantum noise to his part of the 
state after receiving it. 
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Figure 4. Noise scenario 4; Alice adds classical noise to her classical bit string. 



4. Secret key rate 

The aim of this section is to investigate the effect of the various noise scenarios explained 
in the previous section on the finite e-secure key rate r in Equation (I2.13p . 

From the fact that Alice and Bob share in the beginning a maximally entangled 
state (see Equation (13. ip ) we know that the action of a depolarizing channel on Alice's 
part or on Bob's part results in the same total state. This implies that the states Pabe 

(2) 

and p\be are identical for p a = pi, and the noise scenarios 1 and 2 are equivalent. 

Additionally, we now show the equivalence of noise scenario 1 and 4, i.e. adding 
rotationally invariant quantum noise is equivalent to adding classical noise. Let us 
assume for noise scenario 4 that we add classical noise with probability ^ to flip a 
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bit (see Definition |2J) to a bit-string resulting from measurements in the z-basis. In 
noise scenario 1 only the Pauli-operators o x and a y from the depolarizing channel (see 
Definition [I]) lead to a bit-flip, such that the total probability to flip a bit is given by 
£f + = ^f. Note that for the cases in scenario 4 that the bit-strings were obtained 
by measurements in x (y)-basis the same argument holds. Then only a y and o z (a x and 
a z ) lead to bit-flips in scenario 1, and due to the symmetry of the depolarizing channel 
the probability to flip is also in both cases. This implies the equivalence of scenario 
1 and scenario 4 for p a = p d . 

Noise scenario 3 will not lead to any benefit for the key rate as it only increases 
the quantum bit error rate (QBER). This asymmetry between noise scenario 2 and 3 is 
due to the underlying one-way error-correction protocol, such that adding Bob's noise 
after Eve's interaction only influences the key rate r by increasing H(X\Y). 

The equivalence of the noise scenarios 1, 2 and 4, together with the fact that scenario 
3 can only be detrimental for the secret key rate, enable us to focus for the rest of this 
paper on a specific noise scenario, namely noise scenario 1. We start for simplicity with 
the investigation of the asymptotic key rate (i.e. Equation (12.131) for N — > oo, e — > 0) 
given by [28] 

r asym = S(X\E)-H(X\Y). (4.1) 

Later, the effect of noise on the finite key rate (see Equation (I2.13P ) follows by including 
the finite-size effects. 

In order to determine Eve's unknown probes in the state Pabe> given in Eq. (13. 3p . 
namely \A) E , \B) E , \C) E , \D) E , we expand each probe in basis vectors 

\A) E = a a |00) + a |01> + 7 a |10) + 5 a |11) (4.2) 

with the normalization condition 



a, 



| 2 + |/3a| 2 + |7a| 2 +|5 a r 



1 



(4.3) 



and a similar parametrization for \B) E , \C) E , \D) E , with indices b, c, d, respectively. A 
partial-trace operation on p^ BE over Eve's part leads to the state p^ B , which corresponds 
to the state shared by Alice and Bob after Eve's unitary interaction. It has been shown 
in [251 [26j that the BB84 and the six-state protocol permit to characterize the state p^ B 
as Bell-diagonal, parametrized by the quantum bit error rate Q. 



Pab 



Ai 



+ A 2 



+ A 3 



+ X 4 



with the Bell-states 

$ : 

and the parameters 
A a 



7^(|01>±|10» 



y/2 



(|00>±|11» 



1- 2^ A 2 



A-? — Xa 



Q 
2 



(4.4) 

(4.5) 
(4.6) 

(4.7) 
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for the six-state protocol, while 

A : = 1 - 2Q + A 4 , A 2 = A 3 = Q - A 4 , A 4 e [0, Q] (4.8) 

for the BB84 protocol. Note that the symmetry properties of p^ B are preserved by 
adding symmetric depolarizing noise (see Definition [1]). 

We can express the QBER Q as a function of the noise parameter p a , which is 
introduced by the depolarizing channel, and Eve's disturbance D: 

Q = {l- Pa )D + ^. (4.9) 

For the six-state protocol we obtain the following additional conditions on Eve's probes: 

(A\B) E = (A\D) E = (B\C) E = (D\C) E = (B\D) E = (4.10) 

and 

W.l.o.g. we can choose \D) E = 1 00) and \B) E = |11). It follows that 

\A) E = (3 a |01) + v/l-|/3 a | 2 |10) , (4.12) 

\C) E = e |01) + y/l- \0 e \* |10) . (4.13) 

By using Equation (14. lip we eliminate (3 a , such that with the constraints in Equation 
( 14.1 Op the state p^be contains only one unknown parameter, namely /3 C . 
Analogously, we get for the BB84 protocol the following constraints: 



and 



(A\B) E = (A\D) E = (B\C) E = (D\C) E = (4.14) 

W.l.o.g. we can choose \A) E = |11) and \B) E = |00). It follows that 

\C) E = y/l-\6 e \*\10) + 6 c \U), (4.17) 
\D) E =a d |01) + y/l- |a d | 2 |10). (4.18) 

By using Equation (I4.15P and Equation (14. 16j) we can reduce the unknown parameters 
of the state p^ BE to the single parameter A 4 . 

Remember that Pab E describes the quantum state shared by Alice, Bob and Eve 
after the state distribution step for noise scenario 1. Let us denote the classical-classical- 
quantum state that results from local von Neumann measurements performed by Alice 
and Bob by Pxye- The states pxe and pxy, which are needed for the calculation of 
the asymptotic key rate in Equation ( 14. ip . follow directly by a partial-trace operation 
on Bob's part and Eve's part, respectively. 

The unknown parameter (3 C (A 4 ) for the six-state protocol (BB84 protocol) has to be 
chosen in such a way that it minimizes the asymptotic key rate in Equation ( 14. ip . such 
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that these states realize Eve's best strategy. After including the finite-key corrections 
(Equation (" 12 . 1 3[) ) into the optimization, the key rate is now fully determined by the noise 
parameter p a and the disturbance D, such that the effects of noise can be calculated, 
also in the regime of a finite number of signals. 

5. Results 

In this section we present our results on the secret key rate in the noisy scenario described 
above. We will discuss two possible interpretations of our results: In subsection 15.11 we 
consider the case that the noise is introduced deliberately by Alice. In subsection 15. 21 we 
analyse the case where the noise is given by the channel and did not originate from the 
eavesdropper. The finite-key rate r (Equation (12.131) ) will be calculated in both cases 
for a total security parameter of e = 10~ 9 . The results are obtained from a numerical 
optimization procedure, which maximizes the key rate with respect to the parameters 
m, e, Epe, £ec, £ pa, while minimizing with respect to the parameters (3 C (A 4 ), for the 
six-state (BB84) protocol. 

5.1. Introducing noise deliberately 

In the following we illustrate the effect of deliberately added noise (see Section [3]) on 
the finite key rate r (see Equation (12. 13ft ). 

In Figure [5] the behaviour of N , the minimal number of signals that is needed to 
extract a non-zero key, with respect to the disturbance D is shown for an optimal noise 
parameter p a (see Figure[6]) for the BB84 and the six-state protocol. In comparison to the 
noiseless case we obtain a beneficial effect on the finite key rate by introducing quantum 
noise p a : In the six-state (BB84) protocol with D = 0.12 (D = 0.1) the improvement 
in the minimal number of signals N is of the order of a million signals. Additionally, 
we find that noise enables us to extract a non-zero key for higher disturbances than in 
the noiseless case: We recover for our case of a finite number of signals the result of 
[25], which states that the maximum tolerated error rate introduced by Eve to extract a 
non-zero key is shifted from 12.6% to 14.1% (11.0% to 12.4%) for the six-state (BB84) 
protocol, in the asymptotic limit No — > oo. 

In Figure [6] we show the optimal noise parameter p a that minimizes Nq and compare 
it to the optimal noise parameter p a that maximizes the asymptotic key rate (Equation 
(I4.ip ) for various disturbances D for the BB84 and the six-state protocol. It turns out 
that the optimal noise parameter p a for the finite case is always higher than the one for 
the asymptotic case. In particular, for the asymptotic key rate the optimal p a becomes 
non-zero for around D = 0.096 (D = 0.083) for the six-state (BB84) protocol, while 
the benefit for the threshold N in the finite scenario appears already for disturbances 
around 0.08 (0.06) for the six-state (BB84) protocol. 

In Figure [7] we show the optimal secret key rate r as a function of the number 
of signals iV for a fixed disturbance D — 0.1 for the BB84 protocol and D = 0.12 
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0.1 0.12 0.14 



Figure 5. Comparison of the optimal minimal number iVo to extract a non-zero key 
(e = 10~ 9 ) versus the QBER D introduced by Eve for the BB84 (circles (black)) and 
the six-state protocol (squares (red)); straight line: noise scenario 1 (see Section [3]), 
dashed line: no noise. 




Figure 6. Comparison of the optimal noise parameter that minimizes No (straight 
lines) for the finite- key rate (Equation (|2.13p ) and the one that maximizes the 
asymptotic key rate (Equation (14. ip ) (dashed lines) versus the QBER D introduced by 
Eve for noise scenario 1 (see Section [3]); circles (black): BB84, squares (red): six-state. 



for the six-state protocol, and compare it to the case without added noise. We obtain 
that the effect of noise on the finite-key rate is more beneficial than the effect on the 
asymptotic key rate, when taking the relative increase of the key rate as figure of merit. 
For example, for iV = 10 8 signals we have an increase of 39% (153%) in the key rate, 
whereas the benefit for iV = 10 16 is only about 20% (50%) for the BB84 (six-state) 
protocol. 

5.2. Noise given by the channel 

The equivalence of noise scenario 1 and 2 for p a = pi, allows us to interpret the results 
obtained in Section H]in another way. In contrast to adding noise deliberately the number 
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0.08 




N 



Figure 7. Comparison of the finite-key rate (Equation (|2.13jl ) versus signals N for a 
fixed disturbance D for the BB84 protocol (D = 0.1) (circles (black)) and the six-state 
protocol (D — 0.12) (squares (red)); straight line: noise scenario 1 (see Section |3|) for 
optimal noise parameter, dashed line: no noise. Lines are drawn to guide the eye. 

Pb can be interpreted as the amount of noise that is introduced by the used quantum 
channel, which is unavoidable in real QKD settings, and not necessarily dedicated to the 
eavesdropper. This interpretation describes the situation in real experiments, where the 
assumption of unconditional security, i.e. all errors introduced by the channel have to 
be attributed to the eavesdropper, is over-pessimistic [291 Ej- ^ one makes the realistic 
assumption that Eve cannot replace the noisy channel by a noisefree one, the channel 
noise does not lead to knowledge of Eve about the key, and the key rate will thus 
increase. In Figure [8] the finite- key rate (Equation (12.131) ) is shown as a function of the 
number of signals N sent through the channel for a fixed QBER (Q = 5%) for different 
values of the noise parameter pb for the six-state and BB84 protocol. The measured 
QBER contains both the noise Pb that we attribute to the channel and the noise D 
that is related to Eve's unitary interaction. For the explicit connection between these 
different types of noise see Eq. (14.91) . Taking this fact into account leads to remarkably 
higher key rates, as shown in Figure [HI For example, for iV = 10 8 signals, without added 
noise the key rate in the six-state (BB84) protocol is 0.37 (0.34), while for channel noise 
of p b = 0.05 it is 0.47 (0.46) for the six-state (BB84) protocol. 

6. Conclusions 

In this article we have shown that the presence of quantum noise can improve secret 
key rates, in particular in the realistic scenario of a finite number of resources. We 
have investigated the effect of different noise scenarios on an e-secure key rate for the 
BB84 and the six-state protocol in the entanglement-based scheme, for a finite number 
of signals. Our results can be interpreted in two ways: First, when taking the view that 
noise is added deliberately, it turns out that the effect of adding depolarizing noise to 
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Figure 8. Comparison of the finite-key rates (Equation (|2.13jl ) (e = fCP 9 ) versus 
number of signals N for various noise parameters pb with QBER = 5% for the BB84 
(circles (black)) and the six-state protocol (squares (red)); dashed lines: pb = 0, 
straight lines: pb = 5%. 

the state (before the state transmisson) is equal to the benefit gained by adding classical 
noise, i.e. when Alice performs probabilistic bit-flips on her measured bit string. We 
obtain that for both the BB84 and the six-state protocol the benefit (concerning the 
key rate) of adding noise is higher in the regime of a finite number of signals than 
for the asymptotic key rate. Second, under the realistic assumption that a channel 
itself introduces noise unavoidably, i.e. the noise is not necessarily created by the 
eavesdropper, the secret key rate increases significantly with respect to the "worst case", 
where all noise is attributed to Eve's intervention. This improvement comes from the 
fact that the errors from the quantum channel do not give Eve information about the 
key. This approach avoids the over-pessimistic assumption of unconditional security, 
and is thus meaningful for realistic experiments. 
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